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SUMMARY 


A trade study has been conducted with the objective of providing a technical 
guideline for selection of the most appropriate computer technology for the Auto- 
matic Flight Control System of a civil subsonic jet transport. 

The trade study considers aspects of using either an analog, incremental type 
special purpose computer or a general purpose computer to perform critical autopilot 
computation functions. It also considers aspects of’ integration of non-critical 
autopilot and autothrottle modes into the computer performing the critical autoland 
functions, as compared to the federation of the non-critical modes into either a 
separate computer or with a R-Nav computer. 

The study is accomplished by establishing the relative advantages and/or risks 
associated with each of the computer configurations. 


INTRODUCTION 


To justify an investigation of the impact of introducing a new technology into 
an existing commercial field, two considerations must be ascertained: 

1. The motivation behind seeking new technology, and 

2. The real advantages to be gained by introducing a particular 
technology. 

Automatic Flight Control systems of civil jet transports have reached the stage 
of seeking a newer electronic technology. Digital control systems are the candidates. 

The purpose of this paper is to describe a method of conducting the background 
trade studies to define the risks and advantages of a technological change. Although 
the application of the method is illustrated in terms of civil aircraft, the 
principles are basic and are applicable in many different areas of industry. 
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MOTIVATIONS 


The analog automatic flight control systems Installed on civil jet transports 
represent significant contribution to the overall cost of development to the airframe 
manufacturer. In the most recent aircraft, the wide bodied Jumbo jets, the automatic 
flight control systems (AFCS) accounted for development and certification monies 
ranging from $10,000,000 to $30,000,000 (1969 to 1970 dollars). On the average, the 
production costs of the wide-bodied jets' AFCS are $300,000. 

Cost of ownership has also become substantial, considering that airlines mainten- 
ance figures show an annual maintenance cost of 1.5i/$100 of initial system cost. 

That amounts to $4500 annually, or $90,000 over the normal life span of the aircraft. 

In general, such high costs have been Incurred because of Increased performance 
and safety requirements. A particular point Is the general requirement for automatic 
landing systems, resulting In Increased redundancy In the sensors, computers, and 
actuators of the AFCS. 

Technological advances In the analog art. In terms of computer architecture and 
electronic component packaging, have managed to keep costs under reasonable control. 

For example, considering only the AFCS electronics, a dual-pitch simplex monitored 
roll configuration of 1966 vintage costs the same as a total duplex pitch-roll system 
developed In 1969. This Is in spite of the fact that the latter system has approx- 
imately 40% greater capability due to redundancy and Increased operational requirements. 

However, the situation doesn't appear to be stable. That is, advancement of 
analog state-of-the-art isn't sufficient to maintain an adequate margin against 
further total cost Increase for future airplanes. One possible solution is to change 
the system technology from analog to digital to provide a more competitive condition 
In meeting yet higher performance and safety requirements. 

Substantial investigation and development has been conducted with digital flight 
control systems (DFCS). However, the accumulated data and conclusions are not 
directly transferable to civil transports because the greatest majority of the programs 
have been militarily oriented. The result is that the basic ground rules of develop- 
ment rely on calculated risk levels for safety, performance, and costs which could not 
be justified for commercial aircraft. 

Therefore, any attempt to realistically judge the attendent risks and advantages 
of developing a commercial DFCS stumbles over the absence of hard trade data. 

"Absolute" data Is available for analog systems because of comprehensive, empirical 
do's - dont's derived from past experience. Such data are not available for commercially 
feasible DFCS. 

A reasonable comparison - or trade study - methodology can be developed in the 
absence of "absolute" data by establishing a relative comparison referenced to a known 
quantity. In the present case, the known quantity Is represented by an analog AFCS 
design In which there is a high level of confidence that It will comply with a sig- 
nificant requirement; the high levdl of confidence resulting from the absolute data 
embodied in established design techniques and practical experience. 
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The reference system can then be arranged In terms of known risk parameters. A 
comparison of each risk parameter, individually with a counterpart parameter of a 
DFCS, can be conducted in a relative sense to determine the increment of risk incurred 
with the DFCS (a negative increment spotlights an advantage). In effect, a sort of 
chain rule is established which allows evaluation of the newer technology system in 
known and understood terms of the older technology system. 


IDENTIFICATION OF REAL ADVANTAGES 


In order to arrange and select appropriate risk parameters, it is necessary to 
identify the risk points of the analog AFCS. A general survey of latest generation 
analog systems will result in the following conclusions: 

1 . Computational Accuracy 

Operational amplifier techniques have reduced computational tolerances to 
levels between 2 and 5%. However, considering the total AFCS - i.e. , sensors, 
guidance signals, actuators, as well as the computers - further reduction of 
computational tolerances loses significance in view of the tolerances and 
inaccuracies of the sensors, guidance signals, etc., which typically range 
between 8 and 20%, 


2. Reliability 


Design and packaging techniques have resulted in analog AFCS computers 
with mean time between failures of thousands of hours. Manufacturer 
warranties of 3000-4000 hours are not uncommon. However, with system-wide 
MTBF's of 200-300 hours, it can be seen that the computers' contribution to 
system railure rates is relatively insignificant. Therefore, substantial 
design activity to further increase computer reliability will not pay off 
proportionately in overall system reliability. 

Another aspect of system relaibiltty is its availability - a direct 
function of the system owner's ability to maintain the system. In this 
respect, analog systems have been shown by experience to’ be deficient. 

Build-in-test-equipment (BITE) is generally provided in all modern analog 
equipment. However, each test feature, being itself analog, requires add- 
itional circuitry dedicated to testing only. The increased complexity 
generated by BITE motivates the designer to restrict BITE to within the 
individual computer. System-wide tests are prohibitive. 


The end result is that fault isolation - to indicate appropriate main- 
tenance activity - within the computer is relatively efficient (about 86% 
in the 747). But the "system effectiveness", defined as 


CONFIRMED FAILURES 1 


X 100%, 


ranges between 20 and 50%. Thus, more than half the owners maintenance 
actvities are inappropriate. 
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3. Redundancy Requirements 

Within the scope of commercial jet transports, existing and imminent, 
redundant systems have relatively little application outside of yaw damping 
(simple stability augmentation) and automatic landing. More exotic require 
ments - flight critical modal suppression or control configured vehicles 
stability systems - are anticipated to be well beyond the next generation 
of civil aircraft. 

Consequently, analog technology has been successfully applied to 
existing redundancy requirements since 1966. 

4. General Cost Considerations 

Each new generation of aircraft is accompanied by a redesign of the 
analog AFCS. Invariably the redesign is necessary to incorporate newer 
packaging techniques to maintain reliability and reduce costs. In effect, 
the AFCS is tailor-made. 

Peripheral costs are induced by the tailoring. Test equipment, tech- 
nician training, etc., must be revised each time an airline re-equips. 


The general conclusions are that an effective comparison between a digital and 
analog AFCS must be parameterized to show substantial advantages in terms of system 
maintainability and costs. Structuring the trade to prove that a digital system is 
as good as an analog system, or to high-light relatively insignificant advantages 
will not provide the supporting data necessary to introduce digital technology into 
commercial AFCS service. 

Therefore, selection of risk parameters associated with maintainability on a 
systems basis, and cost reduction (particularly through reasonable integration of 
system functions) will provide the most effective trade study. 


PRELIMINARY SELECTION OF CANDIDATE SYSTEMS 


Systems can be examined under two aspects, viz, 1) organization, 2) level of 
redundancy. These factors interact to some extent, but generally speaking, system 
organization is the more fundamental factor. Accordingly, candidate systems are 
initially selected by consideration of alternate system organizations. 

A variety of system organizations are available once the decision to employ 
digital technology has been made. Potential candidate systems range between the 
extremes of a central computer that performs all electronic computation, (total inte 
gration) to a one-for-one replacement of analog LRU's (Line Replaceable Units) with 
digital LRU's. The number of potential system candidates must be reduced to make 
detailed trade studies between alternate systems feasible. 
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The extremes, or limiting cases, in the type of system organization may be 
disposed of by general considerations. For example, the one-for-one replacement 
of analog computing LRU's by digital elements obviously negates the advantage of 
time shared digital computing elements in addition to proliferating I/O require- 
ments. Plainly, it offers no advantages in the present application. Indeed, to the 
authors' knowledge, it has never seriously been proposed as a viable digital flight 
control system and it is mentioned and disposed of here for the sake of logical 
completeness. 

The other limiting case - total integration, wherein a number of disparate 
computations such as air data, navigation, cruise autopilot, etc., are performed 
in one computer - has been seriously proposed for a number of applications. From 
certain aspects this is an attractive candidate. Specifically, such a system organ- 
ization yields the minimum number of LRU's, minimizes interface complexity and 
simplifies system test. Nevertheless, this arrangement must also be rejected as 
inappropriate for the application under study. 

The rejection is based on a consideration of the significance of various 
computations that would be performed in a central computer. Some of these com- 
putations are dispatch critical; i.e., the computations must be available if the 
airplane is to be dispatched. Air data computations are an example of computations 
that fall in this category. Other computations, such as cruise autopilot modes or 
autoland are not necessary for dispatch. It is highly desirable from an airline 
point of view, that a "deferred maintenance" policy be employed to the extent poss- 
ible. That is, airlines desire to be able to defer maintenance action until such 
action is convenient from the standpoint of airplane schedule or location. The 
integration of dispatch critical and nondispatch critical functions in a common 
computer is not compatible with a deferred maintenance policy. Furthermore, reli- 
ability of the dispatch critical computations will suffer from piece part consid- 
erations alone. It should be noted that for some applications, such as an RPV, 
where all computations are required for mission success, total integration might be 
the logical choice for system organization. 

There still remains a large number of potential candidate systems even after 
the limiting cases have been rejected. The rationale for further reduction to 
several candidates most promising for detailed trade studies is based on classifying 
the functions and assessing the redundancy requirements. These are shown in Table 1. 

Examination of Table 1 reveals that there are only two functions that are class- 
ified as flight critical; Category III Autoland and Yaw Damping. Both of these 
functions are accordingly assigned a fail -operational redundancy requirement. There 
is a significant difference in these two computations however, since the yaw damping 
function is assumed necessary for high altitude and high Mach number flight (normal 
cruise envelope). Therefore, an operational yaw damper is required for unrestricted 
dispatch. The redundancy requirement for this function results from the requirement 
to maintain artificial yaw damping until a speed-altitude reduction can be effected. 

In contrast, the autoland function is flight critical only during those times 
that Category III conditions prevail; in addition, this function is not required for 
dispatch. The economic penalty for the nonavailability of the yaw damping function 
is consequently much more severe than the penalty for the nonavailability of Category 
III autoland. 
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TABLE 1 


FUNCTION 

CLASSIFICATION 

REDUNDANCY 

REQUIREMENT 

CATEGORY III 
AUTOLAND 

FLIGHT CRITICAL 

FAIL OPERATIONAL 

AUTOTHROTTLE 

NON-CRITICAL 

NONE 

CRUISE AUTOPILOT 
MODES 

NON-CRITICAL 

NONE 

YAW DAMPER 

FLIGHT CRITICAL AT HIGH 
MACH & ALTITUDE; REQUIRED 
FOR UNRESTRICTED DISPATCH 

FAIL OPERATIONAL 

NAVIGATION 

NON-CRITICAL^ 

NONE 

FLIGHT DIRECTOR 

NON-CRITICAL 

NONE 


The remaining functions are seen to be classified as non-critical and similar in 
redundancy requirements. A logical candidate for further study is consequently 
obtained by structuring the system on the basis of a critical /non-critical division 
of functions. This results in a system wherein fail safe functions are performed in 
dual Nav/Flight Control computers and the flight critical autoland is performed in a 
triplex computer arrangement. In the following discussion this system structure is 
designated as a "Federated System". 

Another candidate system (Integrated System) is obtained by performing all auto- 
pilot and autothrottle functions, regardless of criticality, in a set of triply 
redundant computers and navigation functions in separate computers. 


^ Subsequent to 1980 this classification may change to dispatch critical with a 
minimum redundancy requirement of fail -op, but without a requirement for graceful 
degradation of capability after first failure. 
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Based on the previous discussion, three system configurations are developed 
(Figures 1 through 3). The analog computer arrangement in Figure 1 provides the 
"reference" for established technology. It should be noted that this particular 
arrangement shown is not presently in service. Rather, it is a logical evolution 
of system arrangement based on current requirements, and represents the level of 
technical risk acceptable if a change in electronic technology - to digital - were 
not also under consideration. (To attempt the trade study using systems technology 
of, say, 1969, would insert a definite bias factor which could unrealistically 
effect the conclusions.) 

Two types of digital computer technology are considered: General Purpose (GP) 

and Incremental (ICP). The latter shares many of the characteristics of analog 
machines; accordingly, similar system architecture (Figure 1) is postulated for 
systems employing these machines. The similar characteristics make it possible to 
treat the analog and the incremental systems as synonymous except for software 
development and control. 

Application of the general purpose digital computers to the AFCS are illustrated 
in Figures 2 and 3. These configurations were selected to provide comparative 
evaluation of significant design considerations while minimizing unnecessary system 
variables. Figure 2 represents an integrated autopilot system which provides the 
greatest feasible reduction of equipment and interface complexity. Figure 3 repre- 
sents a system arrangement which provides greatest possible isolation of flight 
critical modes to reduce the risks of failure modes oompromising system safety re- 
quirements. 

The selection of these three candidate systems thus provides a means of eval- 
uating contrasting major design factors, that is: 

1. Direct evaluation of digital (General Purpose or Incremental) vs, analog 
technology by consideration of Figure 1 versus Figure 3; 

2. Direct evaluation of the impact of substantial integration by consideration 
of Figure 2 versus Figure 3; and 

3. Direct evaluation of maximum feasible benefits of the digital approach 
by consideration of Figure 1 versus Figure 2. 

After selecting the basic candidate systems, major variations within a system 
configuration may also be considered, as shown by comparing the federated DFCS illus- 
traded in Figures 3 and 4. The effect of including variations will be to provide a 
band of merit in the eventual study results. Such a band of merit provides a means 
of further assessing the sensitivity of system risks/advantage to configuration. 


TRADE STUDY METHODOLOGY 


The identification of key parameters is fundamental in conducting trade studies. 
Two sets of parameters were identified to evaluate the alternate systems, viz: 

"System Parameters" and "Trade Parameters". 
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Trade Parameters were selected to use as a basis of comparison between major 
features of each system. The major features were designated as System Parameters. 
Trade Parameters are weighted according to a Relative Advantage/Risk Factor rationale. 
System Parameters are weighted In accordance with their relative Importance to the 
overall makeup of the system. System Parameters along with their weighting (relative 
Importance factors) are given In Table II. 


TABLE II 


SYSTEM PARAMETER 

FACTOR 

Software Development, Verification 
and Control 

1.0 

I/O Equipment 

1.0 

System Test 

0.7 

Sensor Signal Selection and Fault Detection 

0.6 

Mode Logic and Interlocks 

0.5 

Interties 

0.5 

Processor & Memory Sizing 

0.2 

Control Law Implementation 

0.1 


Trade Parameters are defined as follows: 


Reliability 


Testabi 1 1 ty 


Moni torabi 1 1 ty 


Maintainability 


The Impact which the System Parameter under consid- 
eration has on the system integrity, operational 
availability and ability to meet safety requirements 
(autoland and dispatch critical functions). 

The requirements Imposed on system test In terms of 
hardware/software by the System Parameter being 
evaluated. 

The requirements (In terms of hardware, software and 
engineertng development) to provide failure detection 
for those elements of the System Parameter being 
evaluated. 

The Impact on system fault Isolation to the LRU 
level. 
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Growth Capability The ability of the particular parameter to 

accommodate growth due to expanded system require- 
ments, or Improvements. 

Cost The impact of the parameter on system cost in terms 

of hardware requirements and/or engineering develop 
ment cost. 

Trade Parameter weightings are given in Table III. 


TABLE III 


REUTIVE ADVANTAGE 

RELATIVE RISK 

WEIGHTING FACTOR 

Definite Advantage 


2 

Probabl e Advantage 


1 

No Advantage 

No Risk 

0 


Minor Risk 

-1 


Moderate Risk 

-2 


Severe Risk 

-3 

It will be noted that the weighting system is balanced at "definite 

advantage" vs. "moderate risk". Hence, a severe risk will negatively 

influence a definite advantage making it less desirable. 

Detailed definition of the descriptive terms of Table III are given in 

Table IV. 




The manner in which the System Parameter/Trade Parameter weighting factors are 
combined is shown schematically in Figure 5. A comparison across the systems under 
study, for a given System Parameter is used to select the Advantage/Risk weighting 
factor or score. Engineering judgement enters, of course, into selecting the 
Advantage/Risk score. However, two factors work to minimize purely subjective 
influences. First, a careful choice of System Parameters will isolate the most 
significant aspects of the system structure; likewise the choice of Trade Para- 
meters displays those features or system characteristics that are regarded as 
significant in choosing between competing systems. Thus on this level, tacit 
assumptions are either exposed or rendered nugatory. Secondly, the Advantage/Risk 
scores are selected only after detailed comparative studies of the System Parameters 
under the aspect of the Trade Parameters are made. Again, this procedure works to 
minimize the influence of subjective factors. In addition, the procedure isolates 
any relatively high risk items in the system configuration that is finally selected 
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TABLE IV 


DESCRIPTIVE TEmi 
Definite Advantage 


Probable Advantage 


No risk 


Minor Risk 


Moderate Risk 


Severe Risk 


DEFINITION 


A feature that has, through past experience, been 
demonstrated to be a definite advantage to the 
airplane system or design task in terms of: Performance 
simple design task, desing validation, customer 
acceptance. 


Feature may result in a sugnificant improvement; or 
extentent of improvement is minor ; or anticipated 
benefits are based on extrapolation of similar exper- 
ience in non-related applications. 

Feature has been successfully applied in past 
commercial airplanes; or feature has been successfully 
applied in similar situations without difficulty. 


Has been a problem in past applications, but satis- 
factory solutions were found; or has not been applied 
before, but current evidence shows that it can be 
done without difficulty; or associated problems are 
defined and solutions are available. 

Has been a problem in past applications and soli^4ons 
were difficult to achieve; or depends on a new feature 
with only limited substantiation in practive (i.e. 

Lab, etc.): Or no specific well defined solutions are 
currently available although the problem is well defined. 

Has been a failure or near failure in past applications; 
or depends on a new, unsubstantiated feature; or may 
require radical system redesign if solution is deemed 
unacceptable; or problems are not clearly defined. 



SYSTEM 

PARAMETER 



WEIGHTED 

RATING 


OI 


FIGURE 5 

TRADE STUDY STRUCTURE 




and consequently 1t serves to focus design efforts on critical items. 

A typical example of this procedure taken from a recent trade study is given in 
the Appendix. 


STUDY RESULTS 


Application of the above methodology to the systems of Figures 1, 2, 3, and 4 
yields the data of Figure 6. Summing the weighted rating of this figure for the 
various system parameters gives the following overall figure of merit for the systems 
shown in Figure 7. 

The choice of an analog or incremental system is not warranted because of the 
negative overall ralative rating. The lack of relative advantages for these systems 
are a function of the nature of the computers, Specifically, they perform only a 
part of the automatic flight control system tasks, namely control law calculations. 

The remainder of the tasks - self tests, mode logic, etc. - must be performed by 
additional, external means. 

The figure of merit indicates that the integrated system has the greatest overall 
potential. However, by reviewing the results for each of the system parameters as 
displayed in Figure 6, it can be seen that a potentially high level of risk is 
associated with software development and control. This clearly indicates that a 
major follow-on effort is necessary to resolve the issue and reduce the risk. 
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• BENEFITS OUTWEIGH RISKS 


ANTICIPATED BENEFITS 
ANTICIPATED RISKS 


EQUAL 


• RISKS OUTWEIGH BENEFITS 




UNCLASSIFIED RISK OR ADVANTAGES 


Certain aspects are Important in the final selection of a system which are 
not readily Quantifiable, such as vendor support, commonality of equipment, customer 
choices, ARINC implications, or organizational aspects. The fact that the ICP 
computer is available from a single source would seem to be a risk with regards to 
the above consideration since by selecting that architecture one would effectively 
select the supplier. Customer choices and ARINC implications tend to increase the 
risk incurred by including the non-critical autopilot and autothrottle functions in 
the R-NAV computer. 

Commonality in the various computers used in the airplane would benefit the 
customer by reducing his maintenance and possibly inventory costs. 

The advances in the digital computer hardware state-of-the-art, through large 
scale integration and improved semi-conductor devices, reduces cost while increasing 
computational capacity as well as increasing predicted reliability by reducing the 
number of interconnections within the computer. However, there is the risk incurred 
in the early stages of application of new technology. 

Failure modes effect and criticality analyses (FMECA) present an area of severe 
risk for digital systems. The risk is in terms of assessing the effort required to do 
the FMECA and the probable success achievable. Results of the studies done in the 
"DOT/SST follow-on" program indicate that any attempt at a FMECA according to the 
traditional approach may be a gargantuan task even with computer aided evaluations. 
Similarly, contact with vendors have not revealed any clear methodology for performing 
a thorough FMECA of digital computers. 

Further study is required to assess the FMECA bounds that must be attained to 
meet certification requirements with a digital autopilot. 

The FMECA risk may be alleviated by system design such that the safety is 
assured by "isolated" simple monitoring devices which are amenable to a thorough 
FMECA. 

With regards to the relative comparison of the ICP and GP computers there is 
no appreciable difference in the FMECA risk. 


CONCLUSIONS 


Interpretation of the results of a "relative merit" trade study - such as pre- 
viously described - can be made only within the frameowrk of level of confidence. One 
system configuration which rates relatively lower than another cannot be concluded as 
infeasible. Rather, the confidence of achieving the desired advantages is less than 
the confidence associated with the higher rates system. 

The results of a relative merit trade study, carefully performed, can provide 
quantified conclusions which clearly indicate the best engineering solution for the 
system architecture. Also, weakness of the chosen system are identified in such a 
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manner as to indicate the degree of urgency for follow-on engineering efforts to 
reinforce the weak points. 

Having made relative comparisons against a known quantity (in this case, the 
established technology), reasonable predictions can be formed in terms of the actual 
engineering effort required to introduce the newer technology. 
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APPENDIX 


The following considerations are typical of the judgement required to assess 
the risk or advantage increments between candidate systems for a given parameter. 

The system parameter discussed in this appendix is typical of the various 
parameters which must all be considered to complete the study. For the example 
described in this paper, there were eight major parameters identified. 

I. INPUT/OUTPUT STAGE 
GENERAL NOTES 

1. General Purpose Computer Configurations 

All interfaces for incoming and outgoing signals are accomplished 
within the I/O stage. 

Incoming signals are individually conditioned in dedicated signal- 
conditioning circuits. Two multiplexing units are required, one each 
for critical and non-critical analog signals. The output of each MUX 
goes through common time gating circuits and a single A/D converter, then 
into a parallel -load/serial -output buffer register. 

Digital inputs are loaded into their respective buffer registers 
preparatory to being gated into the computer memory for storage. The A/D 
converter buffer register, and the digital input buffer registers are 
gated as serial data into the computer by a common gating circuit. 

This arrangement is necessary to allow card-level isolation between 
critical and non-critical signals. Common circuitry is always downstream 
of adequate buffering. 

The output signals generated by the computer are treated in a similar 
fashion, i.e., a single D/A conversion followed by individual signal 
conditioning as required. 

Servo amplifiers for elevator and aileron position servos are included 
as part of the I/O stage. 

The high speed yaw dampers are independent analog systems comprising 
control law calculation, engage and disengage control, and servo loop 
electronics in a oackage separate from the AFCS computer. However, low 
speed (flaps down) yaw damping is augmented by turn coordination and yaw 
damping control generated within the AFCS computer. Channels A and B 
provide the upper and lower yaw damper augmentation respectively. Channel 
C's augmentation may be used for monitoring purposes and as a switchable 
hot-spare for either, upper or lower yaw damper. 
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1. General Purpose Computer Configurations (continued) 

The I/O stage also includes an interface between the generated auto- 
throttle commands and the autothrottle (dual) servos. In a similar 
arrangement to the yaw damper augmentation signals, channel C serves as 
a monitoring function and switchafale hot spare for autothrottle control. 


2. Analog Computer Configuration 

The description of the analog "I/O" essentially follows that’ given in 
Note 1, with the following exceptions: 

a. Obvious deletion of MUX requirements. 

b. "Brickwall" configuration, i.e., federated configuration does not 
include interface mixing of critical and non-critical signals. Only 
critical signals are routed into the analog computer. 

c. All yaw damping functions are eliminated from the analog computer 
as illustrated in Figure 1. 
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A COMPARISON OF ALTERNATIVE FLIGHT CONTROL COMPUTER CONFIGURATIONS 


INTEGRATED GP 

INPUT/OUTPUT 

The integrated I/O comprises the 
functions described above and is 
integrally packaged with the computer. 
(A minor risk in the possibility that 
computer volume will dictate separating 
the I/O stage into a separate package 
requiring some additional effort to 
build, test, and install the I/O). 

As discussed in other sections, mode 
logic, monitoring, self test 
capability, and such, are functions 
resident in the computer itself. 
Therefore, the integrated configur- 
ation represents the least complex I/O 
of the three configurations under 
study. 


FEDERATED GP 

INPUT/OUTPUT 

Separating the non-critical from the 
critical functions has only a moderate 
impact on the I/O stage associated with 
the critical computer. The signal 
input is cut approximately in half 
materially reducing the dedicated signal 
conditioning circuits. Output functions 
are reduced only by elimination of auto- 
throttle servo interface. The resulting 
reduction in I/O stage electronic com- 
plexity is somewhat offset by the contin- 
uing requirement for an integrated self 
test of the AFGS for maintenance 
purposes. That is, additional self test 
program control discretes will be re- 
quired to interface between the critical 
system I/O and the non-critical system. 
The net effect, however, is a general 
decrease in complexity of the critical 
I/O stage Which is a definite advantage 
when certification and certificciti on- 
documentation requirements are considered. 


The trade off must also consider the 
impact of locating non-critical 
functions and their associated interface 
requirements in a host machine (such as 
the RNAV) or in completely separate 
packaging. In either case, substantial 
additional equipment must be located 
where it otherwise wouldn't exist. The 
result is a moderate risk in terms of 
cost, reliability, and flexibility 
(growth) of the overall system but with 
no particular advantage accruing from 
the separation. Additionally, it might 
be expected that the separation will 
further complicate management and 


FEDERATED ICP/ANALOG 

INPUT/OUTPUT 

ICP 

This I/O stage follows the same des- 
cription as for the general purpose 
integrated and federated configurations 
and also includes the following notable 
increases in hardware complexity; 

a) Sensor Signal Select and fault 
detection circuitry 

b) Discrete logic voter and monitor 

c) Mode logic 

d) Hardware required for System Self 
Test 

These additional functions, assumed to be 
resident in the software of the general 
purpose machine, will be performed by 
dedicated hardware in this configuration. 
That hardware may take the form of a 
specially made whole word machine, or a 
combination of whole word computation and 
solid state switching mode logic (similar 
to that employed by contemporary auto- 
pilot systems), in either event, this 
represents equipment/circuitry yet to be 
developed and thus is Gonsidered as a 
moderate risk In terms of reliability, 
monitorability, testability, and growth 
capability. 

Further, the I/O state is to be 
separately packaged from the comDuter 
resulting in ah estimated moderate cost 
risk. 



A COMPARISON OF ALTERNATIVE FLIGHT CONTROL COMPUTER CONFIGURATIONS 


INTEGRATED GP FEDERATED GP FEDERATED ICP/ANALOG 

conduct of the required self testing ANALOG 

leading to an assessment of minor risk. assessment of the analog interface 

generally follows that of the ICP except 
as qualified by General Note 2. Also, 
the analog interface does not include 
signal sensor selection. This decrease 
in complexity is not reflected in terms of 
significant circuit reduction however. 
Therefore, the overall assessment remains 
similar to that of the ICP, i.e., moderate 
riisk in terms of reliability, monitorability, 
and testability. Growth capability is 
very difficult to achieve, therefore it 
represents a severe risk. 

The interface is inherently integrated 
with the analog system, thus costs are 
predictable. Consequently, no risk can 
be established here. However, no signi- 
ficant advantage is identified either. 



